This is a follow-up to #1409198: '400' Status: Bad Request within View. A @todo comment was left in SarniaSolrService::configurationFormValidate() stating the possible need for validation of input to the new requestHandler configuration option. My main concern is that it could be used to inject additional parameters into requests. We need to:

1. Figure out if validation is necessary.
2. Decide what kind of validation is appropriate (I couldn't find any naming conventions/restrictions for requestHandlers in the Solr docs when I wrote the original patch, which is why I didn't add validation at that time).
3. Write a patch to add the validation.

I also want to mention that a feature request was made by the IT dept. head where I work. He asked if the configuration field could be turned into a select list that automatically populated with the requestHandlers available in the server's solrconfig.xml file. He didn't want anyone to have to just know what the requestHandler name is or to have to go looking through the config file for it. I thought this was a great idea and it would eliminate the need for validation (probably).

In practice the select list turned out to not be very feasible. I've looked quite a bit and I can't find any documentation about Solr having the ability to identify its requestHandlers and return a list of them in a request. The only possible solution I could think of is to request the server's configuration files (just like how you can see them in a Solr server's Search API page), then parse the solrconfig.xml file for a list of all the requestHandler names. That requires you to instantiate a server object first and when I started digging in to how to do that I just decided it wasn't worth the trouble.

Still, I think the select list is a good idea in theory. If anyone has ideas for implementing it then we could change the purpose of this issue.

Comments

jmdeleon’s picture

Status: Active » Closed (outdated)

Closing really old issues.